Myalbum2007的查杀 bbs.ikaka.com

baohe - 2007-7-2 22:37:00

此毒在windows文件夹释放一个Myalbum2007.zip（图1）；在system32文件夹释放一个sysprinters.dll。此dll可插入多个应用程序进程。

中招后，SRENG日志可见下列异常：

启动项目
注册表

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<system32><sysprinters.dll> []
==================================
正在运行的进程

[PID: 492][C:\windows\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\sysprinters.dll] [N/A, ]
[PID: 1448][C:\windows\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\sysprinters.dll] [N/A, ]
[PID: 1460][C:\Program Files\Tiny Firewall Pro\amon.exe] [Computer Associates International, Inc., 6.5.3.2]
[C:\windows\system32\sysprinters.dll] [N/A, ]
[PID: 1536][C:\Program Files\Internet Download Manager\IDMan.exe] [Internet Download Manager Corp., Tonec Inc. , 5, 0, 2, 5]
[C:\windows\system32\sysprinters.dll] [N/A, ]
[PID: 1912][C:\Program Files\Opera9\Opera.exe] [Opera Software, 8679]
[C:\windows\system32\sysprinters.dll] [N/A, ]
[PID: 844][C:\Program Files\WinRAR\WinRAR.exe] [Alexander Roshal, 3.42]
[C:\windows\system32\sysprinters.dll] [N/A, ]

查杀流程：

1、打开注册表编辑器，展开：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
删除：system32
展开：HKEY_CLASSES_ROOT\CLSID\
删除{BB009077-4264-4655-B212-FAB1CAF1DE62}（其中的InProcServer32默认值为"sysprinters.dll"

2、重启系统。
3、删除病毒文件（图2）。

附件: 155847200772222738.jpg

baohe - 2007-7-2 22:38:00

图2

附件: 155847200772222831.jpg

无敌剑仙 - 2007-7-2 23:00:00

收到了
猫兄
不过，看日志比较眼疼

火神gggg - 2007-7-3 0:55:00

谢谢楼主,学习了,呵呵

超级游戏迷 - 2007-7-3 1:13:00

已收藏，感谢猫兄…………

pigboy - 2007-7-3 3:13:00

谢谢猫叔

孤独更可靠 - 2007-7-3 8:12:00

学习了

和以前的MSN蠕虫差不多啊?

spiritfire - 2007-7-3 8:23:00

学习…………

上下上下 - 2007-7-3 9:27:00

好久不来，第一帖给你了！新病毒，预防下~~

HOSTのS - 2007-7-3 9:49:00

收藏.....

sunbi12345 - 2007-7-3 10:23:00

学习了，谢谢！！

暗焰欣空 - 2007-7-3 12:17:00

学习学习

木马将军 - 2007-7-3 14:51:00

猫叔的帖全收藏!!!!

努力学习技术 - 2007-7-3 15:14:00

俺昨天帮同事看此解压后文件怎么打开，copy过来运行中的，今个才发现，不过重起后被symantec给干掉了。嘘口气，还不是太可恶。

大虾们能帮我看下扫描后的日志还有无问题，谢谢！！！
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<bgswitch><C:\WINDOWS\system32\bgswitch.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe> [(Verified)Symantec Corporation]
<igfxhkcmd><C:\WINDOWS\system32\hkcmd.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<ccApp><; "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [(Verified)Symantec Corporation]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
<XFILTER><"C:\Program Files\Filseclab\xfilter\xfilter.exe" -a> [费尔安全实验室]
<RAMDrive><"C:\Program Files\FarStone\VirtualDrive\VHD\RDTask.exe"> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
<WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><C:\WINDOWS\system32\NavLogon.dll> [(Verified)Symantec Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\System Safety Monitor]
<WinlogonNotify: System Safety Monitor><SSMWinlogonEx.dll> [(Verified)System Safety Limited]

==================================
启动文件夹
[费尔消息服务]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\费尔消息服务.lnk --> C:\PROGRA~1\COMMON~1\FILSEC~1\FilMsg.exe [费尔安全实验室]><N>

==================================

努力学习技术 - 2007-7-3 15:18:00

服务
[Symantec Event Manager / ccEvtMgr][Running/Auto Start]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc][Stopped/Manual Start]
<"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr][Running/Auto Start]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch][Running/Auto Start]
<"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[HP WMI Interface / hpqwmi][Stopped/Manual Start]
<C:\Program Files\HPQ\SHARED\HPQWMI.exe><Hewlett-Packard Development Company, L.P.>
[LightScribeService Direct Disc Labeling Service / LightScribeService][Running/Auto Start]
<"C:\Program Files\Common Files\LightScribe\LSSrvc.exe"><Hewlett-Packard Company>
[P4P Service / P4P Service][Running/Auto Start]
<C:\Program Files\Common Files\Sogou PXP\p2psvr.exe><Sohu.com Inc.>
[SavRoam / SavRoam][Stopped/Manual Start]
<"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
[Symantec Network Drivers Service / SNDSrvc][Stopped/Manual Start]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[Symantec SPBBCSvc / SPBBCSvc][Stopped/Manual Start]
<"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus][Running/Auto Start]
<"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[VMware Authorization Service / VMAuthdService][Stopped/Auto Start]
<C:\Program Files\VMware\VMware Workstation\vmware-authd.exe><VMware, Inc.>
[VMware DHCP Service / VMnetDHCP][Stopped/Auto Start]
<C:\WINDOWS\system32\vmnetdhcp.exe><VMware, Inc.>
[VMware Virtual Mount Manager Extended / vmount2][Stopped/Auto Start]
<"C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe"><VMware, Inc.>
[VMware NAT Service / VMware NAT Service][Stopped/Auto Start]
<C:\WINDOWS\system32\vmnat.exe><VMware, Inc.>
[Windows Media Connect Service / WMConnectCDS][Stopped/Manual Start]
<C:\Program Files\Windows Media Connect 2\wmccds.exe><Microsoft Corporation>
[Windows Driver Foundation - User-mode Driver Framework / WudfSvc][Stopped/Manual Start]
<C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup-->%SystemRoot%\System32\WUDFSvc.dll><Microsoft Corporation>

==================================
驱动程序
[Conexant AMC Audio / CAMCAUD][Running/Manual Start]
<system32\drivers\camc6aud.sys><Conexant Systems Inc.>
[CAMCHALA / CAMCHALA][Running/Manual Start]
<system32\drivers\camc6hal.sys><Conexant Systems Inc.>
[cbb6B / cbb6B][Stopped/Manual Start]
<\??\C:\DOCUME~1\dong\LOCALS~1\Temp\cbb6B.sys><N/A>
[eabfiltr / eabfiltr][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\EABFiltr.sys><Hewlett-Packard Company>
[eabusb / eabusb][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\eabusb.sys><Hewlett-Packard Company>
[Symantec Eraser Control driver / eeCtrl][Running/System Start]
<\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys><Symantec Corporation>
[fcdabus / fcdabus][Stopped/Boot Start]
<\SystemRoot\system32\DRIVERS\fcdabus.sys><N/A>
[RamDisk Drive Service / fsRamDsk][Stopped/Manual Start]
<system32\DRIVERS\fsRamDsk.sys><N/A>
[hcjpqlgc / hcjpqlgc][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\hcjpqlgc.sys><N/A>
[VMware hcmon / hcmon][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\hcmon.sys><VMware, Inc.>
[HSFHWICH / HSFHWICH][Running/Manual Start]
<system32\DRIVERS\HSFHWICH.sys><Conexant Systems, Inc.>
[HSF_DP / HSF_DP][Running/Manual Start]
<system32\DRIVERS\HSF_DP.sys><Conexant Systems, Inc.>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[mdmxsdk / mdmxsdk][Running/Auto Start]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[NAVENG / NAVENG][Running/Manual Start]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070702.017\naveng.sys><Symantec Corporation>
[NAVEX15 / NAVEX15][Running/Manual Start]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070702.017\navex15.sys><Symantec Corporation>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\E:\other\program files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nskaba5 / nskaba51][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\nskaba51.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[rjrcki / rjrcki][Stopped/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\rjrcki.sys><N/A>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
<system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[System Safety Monitor 2.0 Core Engine / safemon][Running/Boot Start]
<\SystemRoot\system32\drivers\safemon.sys><System Safety Limited>
[SAVRT / SAVRT][Running/System Start]
<\??\C:\Program Files\Symantec AntiVirus\savrt.sys><Symantec Corporation>
[SAVRTPEL / SAVRTPEL][Running/System Start]
<\??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys><Symantec Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[USB PC Camera (SNPSTD3) / SNPSTD3][Stopped/Manual Start]
<system32\DRIVERS\snpstd3.sys><>
[SPBBCDrv / SPBBCDrv][Stopped/Manual Start]
<\??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys><Symantec Corporation>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[SSL-VPN NetExtender Adapter / SSLDrv][Stopped/Manual Start]
<system32\DRIVERS\SSLDrv.sys><SonicWALL Inc.>
[SymEvent / SymEvent][Running/Manual Start]
<\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[SYMREDRV / SYMREDRV][Stopped/Manual Start]
<\SystemRoot\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
[SYMTDI / SYMTDI][Running/System Start]
<\SystemRoot\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[tifm21 / tifm21][Running/Manual Start]
<system32\drivers\tifm21.sys><Texas Instruments>
[vaxscsi / vaxscsi][Stopped/Manual Start]
<\SystemRoot\System32\Drivers\vaxscsi.sys><N/A>
[VMware Virtual Ethernet Adapter Driver / VMnetAdapter][Stopped/Manual Start]
<system32\DRIVERS\vmnetadapter.sys><VMware, Inc.>
[VMware Bridge Protocol / VMnetBridge][Running/Auto Start]
<system32\DRIVERS\vmnetbridge.sys><VMware, Inc.>
[VMware Network Application Interface / VMnetuserif][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\vmnetuserif.sys><VMware, Inc.>
[VMware vmx86 / vmx86][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\vmx86.sys><VMware, Inc.>
[Vstor2 Virtual Storage Driver / vstor2][Running/Auto Start]
<\??\C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vstor2.sys><VMware, Inc.>
[winachsf / winachsf][Running/Manual Start]
<system32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[Windows Driver Foundation - User-mode Driver Framework Platform Driver / WudfPf][Stopped/Manual Start]
<system32\DRIVERS\WudfPf.sys><Microsoft Corporation>
[Windows Driver Foundation - User-mode Driver Framework Reflector / WudfRd][Stopped/Manual Start]
<system32\DRIVERS\wudfrd.sys><Microsoft Corporation>
[Filseclab Packet Filter / XPacket][Running/Boot Start]
<\SystemRoot\System32\xpacket.sys><Filseclab Corporation>
[XPROTECTOR / XPROTECTOR][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\Xprotector.sys><N/A>

==================================

努力学习技术 - 2007-7-3 15:19:00

浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\PROGRA~1\FlashGet\jccatch.dll, FlashGet>
[AcroIEToolbarHelper Class]
{AE7CD045-E861-484f-8273-0445EE161910} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll, N/A>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[启动Web迅雷]
{962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[金山词霸]
{9A687CA6-D585-4947-9ED9-BE96071F5CD9} <C:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll, 金山软件股份有限公司>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\other\program files\Tencent\QQ\QQ.EXE, TENCENT>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\flashget.exe, FlashGet.com>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Adobe PDF]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[XTunnelCtrl Class]
{50580095-16DB-4B28-BCFC-70989E09AA5F} <C:\WINDOWS\DOWNLO~1\xtunnel.dll, SonicWALL Inc.>
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
[WebThunder Class]
{03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\PROGRA~1\FlashGet\jccatch.dll, FlashGet>
[IEHandle Class]
{31EBA2E2-58B2-4980-9C41-F12F5F1422C5} <C:\WINDOWS\system32\TPHANDLE.dll, 江苏科建教育软件有限责任公司>
[Adobe PDF]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll, N/A>
[XTunnelCtrl Class]
{50580095-16DB-4B28-BCFC-70989E09AA5F} <C:\WINDOWS\DOWNLO~1\xtunnel.dll, SonicWALL Inc.>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[AcroIEToolbarHelper Class]
{AE7CD045-E861-484F-8273-0445EE161910} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll, N/A>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[上传到QQ网络硬盘]
<E:\other\program files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用Web迅雷下载]
<C:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
<C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Excel(&x)]
<res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<E:\other\program files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\other\program files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\other\program files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 544][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 596][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 620][\??\C:\WINDOWS\SYSTEM32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\SYSTEM32\SSMWinlogonEx.dll] [System Safety Limited, 2.3.0.612]
[C:\WINDOWS\system32\NavLogon.dll] [Symantec Corporation, 10.0.0.359]
[C:\WINDOWS\SYSTEM32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\SYSTEM32\igfxdev.dll] [Intel Corporation, 3.0.0.4363]
[PID: 668][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 680][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Filseclab\xfilter\XFILTER.DLL] [Filseclab Corporation, 3, 0, 3, 3715]
[PID: 832][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 920][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Filseclab\xfilter\XFILTER.DLL] [Filseclab Corporation, 3, 0, 3, 3715]
[PID: 1008][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Filseclab\xfilter\XFILTER.DLL] [Filseclab Corporation, 3, 0, 3, 3715]
[PID: 1920][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\WPDShServiceObj.dll] [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\PortableDeviceTypes.dll] [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.4363]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4363]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4363]
[C:\WINDOWS\system32\igfxress.dll] [Intel Corporation, 3.0.0.4363]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll] [Symantec Corporation, 10.0.0.359]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\PROGRA~1\FlashGet\jccatch.dll] [FlashGet, 1, 1, 5, 0]
[C:\Program Files\Common Files\Adobe\Shell\PSICON.DLL] [Adobe Systems, Incorporated, 7.0]
[PID: 988][C:\PROGRA~1\SYMANT~1\VPTray.exe] [Symantec Corporation, 10.0.0.359]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.5.0.44]
[C:\Program Files\Symantec AntiVirus\Cliscan.dll] [Symantec Corporation, 10.0.0.359]
[C:\PROGRA~1\SYMANT~1\NAVNTUTL.DLL] [Symantec Corporation, 10.0.0.359]
[C:\Program Files\Symantec AntiVirus\Cliproxy.dll] [Symantec Corporation, 10.0.0.359]
[PID: 1060][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 8.2.4 10Nov05]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 8.2.4 10Nov05]
[C:\WINDOWS\system32\SynTPAPI.dll] [Synaptics, Inc., 8.2.4 10Nov05]
[PID: 1372][C:\Program Files\Filseclab\xfilter\xfilter.exe] [费尔安全实验室, 3, 0, 3, 8981]
[C:\Program Files\Filseclab\xfilter\XFILTER.DLL] [Filseclab Corporation, 3, 0, 3, 3715]
[PID: 1408][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1776][C:\Program Files\Common Files\Filseclab\FilMsg.exe] [费尔安全实验室, 4, 0, 3, 999]
[C:\Program Files\Common Files\Filseclab\twsupdate.dll] [Filseclab Corp., 1, 0, 1, 497]
[C:\Program Files\Common Files\Filseclab\W32Tools.dll] [Filseclab Corp., 1, 0, 2, 1642]
[C:\Program Files\Common Files\Filseclab\FAPIConv.dll] [Filseclab Corp., 1, 0, 0, 45]
[C:\Program Files\Common Files\Filseclab\mdcoder.dll] [Filseclab Corp., 1, 0, 0, 21]
[C:\Program Files\Filseclab\xfilter\XFILTER.DLL] [Filseclab Corporation, 3, 0, 3, 3715]
[PID: 3692][E:\soft\工具\SRE\kfje76723.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Filseclab\xfilter\XFILTER.DLL] [Filseclab Corporation, 3, 0, 3, 3715]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
C:\Program Files\Filseclab\xfilter\XFILTER.DLL(Filseclab Corporation, Filseclab Personal Firewall)
MSAFD Tcpip [UDP/IP]
C:\Program Files\Filseclab\xfilter\XFILTER.DLL(Filseclab Corporation, Filseclab Personal Firewall)
MSAFD Tcpip [RAW/IP]
C:\Program Files\Filseclab\xfilter\XFILTER.DLL(Filseclab Corporation, Filseclab Personal Firewall)
RSVP UDP Service Provider
C:\Program Files\Filseclab\xfilter\XFILTER.DLL(Filseclab Corporation, Filseclab Personal Firewall)
RSVP TCP Service Provider
C:\Program Files\Filseclab\xfilter\XFILTER.DLL(Filseclab Corporation, Filseclab Personal Firewall)

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

haohe的fans - 2007-7-3 16:44:00

谢了

我是流浪猪 - 2007-7-3 16:46:00

学习…………

rabby1982 - 2007-7-3 16:51:00

请问怎么打开注册表编辑器?

85991168 - 2007-7-3 17:58:00

估计我是没中呵呵

射手的神话 - 2007-7-3 21:37:00

这个毒释放的东西不多外。

射手的神话 - 2007-7-3 21:40:00

【回复“rabby1982”的帖子】

开始运行输入regedit 回车

dhfish - 2007-7-4 0:12:00

楼主，请求帮助！

我中招了，弄了两天都没弄好。

我在瑞星主站看到了msn相片病毒的手动删除。症状很相同，我就照着做。

可是在注册表中找不到所说的文件，最后我就把我能找到的东西给删了，如收的原始文件，windows下的myalbum.zip，后来知道是system32里的sysprinter在作怪，可我怎么都删不了，始终显示写保护正在使用中。
我现在瑞星升级了，可识别不出这个毒，请问我现在该怎么办？难道一定得重装系统吗？

不好意思，我不知道怎么给你看日志。
谢谢！！！

love360 - 2007-7-4 1:07:00

专杀早就出来了

看看http://www.lofocus.com/MsnWormKill.asp吧

dhfish - 2007-7-4 1:15:00

谢谢！！

瑞星这次升级后，把这个毒给杀了。

kiss88 - 2007-7-4 2:06:00

不知道为什么,我的电脑老是死机~特别是和瑞星杀毒一起用的时候~差不多快扫描完的时候又会死机~我也不知道是为什么版主可以告诉我吗~!?谢谢了

xiaoxiongjoy - 2008-2-28 18:51:00

学习了

瑞星卡卡安全论坛